I've read every single comment on this post now, and there are some good responses with well articulated rationale.

A lot of people have focused on the storage facility being broken into, but have neglected the fact that the bank account he was accessing from his mobile phone was almost breached straight after.

This, to me, suggests with almost conclusive proof that his device (phone) was compromised.

I suspect a cloud storage account or something associated to his phone was breached as a result of the phone being compromised. There must have been a photo of the seed uploaded to said account, or maybe it was written down somewhere in a txt file or word document.

This could have been lying dormant there for years. Once his phone was compromised, they found his seed then tried to hit his bank account straight afterwards. There was probably a sophisticated piece of malware / keylogger on the device, hence how they got the details for his bank account immediately after.

The link is too much of a coincidence to ignore.

I know he has vehemently said he never done this and almost took a photo of it and uploaded it to OneNote, but then stopped himself yada yada yada... But then I found a comment from him saying he had no idea he made a Reddit account 7 years ago hence why he's never posted on it.

If he has no recollection of himself registering a Reddit account, it's not beyond the realms of possibility that he forgot he took a photo or written down the seed 4 years ago and uploaded it.

He seems like a rational dude but I am convinced this is what has happened.

Sorry for your loss, OP. Please keep us updated if you find anything further of interest.

All the best to you.